Source: supabase/agent-skills · Maintainer: Supabase · License: MIT · Checked: 24 October 2026
What is the Supabase skill?
The Supabase skill is the official supabase Agent Skill from Supabase: one skill that your coding agent loads for any Supabase work, from Auth and Row Level Security to migrations, Edge Functions and debugging. Install it with npx skills add https://github.com/supabase/agent-skills --skill supabase.
Its SKILL.md description opens: "Use when doing ANY task involving Supabase." It then lists triggers across Supabase products, client libraries such as supabase-js and @supabase/ssr, auth issues, the CLI and MCP server, schema changes, Postgres extensions, and errors such as "RLS surprises" and "schema cache issues."
It is the second skill in the repo, next to Postgres best practices. As of 24 October 2026, its skills.sh page listed 340.9K installs (snapshot, 24 October 2026).
What does it do?
The SKILL.md is built around six core principles, then sections on the CLI, the MCP server, docs, schema changes and debugging.
Core principles.
- Check what changed. "Do not rely on training data for Supabase features." The agent fetches
https://supabase.com/changelog.md, scans forbreaking-changetags, then reads the relevant docs. - Verify your work. "A fix without verification is incomplete."
- Don't loop. If an approach fails after two or three attempts, stop and try a different method.
- Exposing tables to the Data API. New tables may not be exposed automatically, so
anonandauthenticatedmay need explicit grants. That is separate from RLS. - RLS in exposed schemas. Enable RLS on every table in any exposed schema, including
public, with policies that match the real access model. - Security checklist. Run it for anything touching auth, RLS, views, storage or user data.
The security checklist is the part most worth reading. Examples:
| Trap | What the skill says |
|---|---|
user_metadata in authorization |
User-editable; use app_metadata instead |
| Deleting a user | Does not invalidate existing access tokens |
service_role key in a client |
Never; prefer publishable keys, and remember any NEXT_PUBLIC_ variable reaches the browser |
| Views | Bypass RLS by default; use security_invoker = true on Postgres 15 and above |
| UPDATE with no SELECT policy | Silently updates 0 rows |
auth.role() |
Deprecated; use TO authenticated or TO anon |
TO authenticated alone |
Authentication without authorization; add an ownership check in USING |
| UPDATE policies | Need both USING and WITH CHECK |
SECURITY DEFINER functions |
Bypass RLS; never add one to fix a permission error |
| Storage upsert | Needs INSERT, SELECT and UPDATE |
CLI and MCP. The CLI rule is "Always discover commands via --help" and never guess, because the command structure changes between versions. It notes that supabase db query needs CLI v2.79.0 or later and supabase db advisors needs v2.81.3 or later, with MCP fallbacks. For the MCP server it gives four troubleshooting steps, ending with scoped personal access token permissions.
Schema changes. The agent first checks whether the project uses declarative schemas (supabase/schemas/) or imperative migrations. For migrations it iterates with execute_sql or supabase db query, avoids apply_migration on a local database, runs advisors, then generates the file with supabase db pull <descriptive-name> --local --yes.
Debugging. On any Supabase error, the agent "must" read Supabase's Monitoring and Debugging docs before proposing a fix.
The folder also has references/skill-feedback.md and assets/feedback-issue-template.md, which let the agent, with your permission, draft a GitHub issue to the maintainers when the skill gives wrong guidance, plus a CHANGELOG.md.
How do you install it?
The repo README and Supabase's AI skills docs list these routes.
Just this skill. The command on skills.sh:
npx skills add https://github.com/supabase/agent-skills --skill supabase
The README's shorter form, npx skills add supabase/agent-skills --skill supabase, does the same. Drop --skill to install both Supabase skills. Add -g (or --global) to install for all projects; the folder then lands in ~/.claude/skills/supabase/ instead of .claude/skills/supabase/, the standard Claude Code skill locations.
Claude Code plugin.
claude plugin marketplace add supabase/agent-skills
claude plugin install supabase@supabase-agent-skills
Updates. Supabase's docs say the skills are updated frequently and give npx skills update to pull new versions.
Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills. For the MCP server itself, follow Supabase's MCP setup guide.
How do you use it?
The skill loads on its own for Supabase work. Example prompts (suggestions, not quotes from the repo):
Help me set up Supabase Auth with Next.js(one of the README's own examples)Add a profiles table with RLS so users can only read and edit their own row.My update query returns no error but changes nothing. Check the RLS policies.Review our views and functions against the Supabase security checklist.Turn the schema changes I made locally into a migration file.
Requirements: a Supabase project, and either the Supabase CLI (recent enough for db query and db advisors) or the Supabase MCP server. For CI and agents, the skill recommends a scoped personal access token over the classic token that supabase login creates in the browser, because a classic token carries full account access.
Tips and limits
- It acts on your database. No scripts ship with the skill, but it tells the agent to run SQL and CLI commands. Point it at a local or branch database first.
- Docs access matters. The skill expects the agent to fetch the changelog and docs pages. Without network access you still get the checklist and workflows.
- Frontmatter version lags. The SKILL.md metadata says
0.1.2while the folder's changelog reaches 0.1.9 (28 September 2026), so go by the changelog. - Audits. On 24 October 2026, skills.sh showed Pass from Gen Agent Trust Hub and Socket, and Warn from Snyk (audited 2 October 2026) for third-party content exposure, scored low risk because it reads Supabase's own docs.
- License. MIT: copy and change it, keeping the copyright notice.
Save it in your Kipt library
In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt reads the SKILL.md with its references and assets; paste the repo link instead and it shows both Supabase skills to pick from. Your skills stay in a private GitHub repo you own and install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Supabase.
Similar skills
- Postgres best practices skill: Supabase's companion skill for indexes, pooling, locking and RLS performance.
- Stripe skill: Stripe's official skill, often next to Supabase in a SaaS stack.
- Security hardening skill: general app security rules to pair with the Supabase checklist.
- Cloudflare Workers skill: if your API runs on Workers in front of Supabase.